SOC Manager

Fidelity National Financial•Jacksonville, FL

3d•Onsite

About The Position

The Security Operations Center (SOC) Manager leads and matures a 24x7 enterprise SOC supporting a global Fortune 500 organization. The role oversees a geographically dispersed team of security analysts responsible for threat detection and response, and provides strategic and operational leadership to ensure rapid detection and response to cyber threats while continuously improving people, processes, and technology. The SOC Manager partners with teams across information security, IT, risk management, legal, privacy, and business leadership to protect the organization from evolving cyber risks. The role is based in Jacksonville, Florida, with interaction across global teams and time zones. Participation in major incident response activities outside standard business hours may be required; travel may rarely be required for team engagement or leadership meetings.

Requirements

Bachelor’s degree in Information Security, Computer Science, or a related field, or equivalent practical experience.
At least 8 years of experience in cybersecurity operations, incident response, or threat detection.
At least 3 years of experience managing security teams or leading SOC operations.
Hands-on experience with enterprise security tools, including SIEM, EDR/XDR, and threat intelligence platforms.
Strong understanding of attacker tactics, techniques, and procedures (TTPs).
Proven ability to lead teams in high-pressure, time-sensitive environments.
Excellent communication skills and ability to brief technical and non-technical stakeholders.

Nice To Haves

Experience operating a SOC in a large, complex, or regulated enterprise environment.
Relevant certifications such as CISSP, CISM, GCED, GCIH, or equivalent.
Familiarity with cloud security operations in AWS, Azure, or GCP.
Experience managing globally distributed or follow-the-sun SOC models.
Prior experience supporting executive-level incident communications.

Responsibilities

Lead, mentor, and develop a geographically distributed SOC team, including analysts across multiple shifts and regions.
Promote accountability, continuous improvement, and operational excellence.
Define SOC roles, skill sets, training paths, and career development plans.
Manage staffing models for 24x7 operations, including on-call rotations.
Oversee daily SOC operations, including monitoring, triage, investigation, containment, and remediation of security incidents.
Ensure consistent execution of incident-response playbooks and standard operating procedures.
Coordinate cross-functional response efforts with DFIR, IT, legal, privacy, HR, and communications teams.
Ensure effective use and continuous improvement of SIEM, XDR, NDR, and threat intelligence platforms.
Improve detection use cases, alert fidelity, and automation.
Evaluate emerging threats and attacker techniques and translate intelligence into actionable detection strategies.
Define and track SOC KPIs and metrics, including MTTD, MTTR, alert quality, and coverage.
Report SOC performance, risk posture, and incident trends to executive leadership.
Ensure SOC operations align with internal policies, regulatory requirements, and industry frameworks such as NIST.
Develop and execute a multi-year SOC maturity roadmap aligned with business and risk priorities.
Identify opportunities for process optimization, automation, and technology improvements.
Participate in vendor evaluation, tool selection, and budget planning related to SOC capabilities.
Support audits, tabletop exercises, and purple team activities.